Detect-It-Easy/db/PE/RADBasic.4.sg

// Detect It Easy: detection rule file

init("compiler", "RAD Basic");

function detect() {
    if (PE.compareEP(PE.is64() ? "48 83 EC" : "E8") && PE.getImportFunctionName(0, 0) === "CloseHandle") {
        const rdataSection = PE.section[".rdata"];

        if (rdataSection && PE.isSignatureInSectionPresent(rdataSection.Number, "'RADBasic'")) {
            bDetected = true;
        }
    }

    _setLang("VB", bDetected);

    return result();
}